During an assessment, a penetration tester sends the following request: POST /services/v1/users/create HTTP/1.1 Host: target-application.com Content-Type: application/json Content-Length: [dynamic] Au

Question

Options

• ADirectory traversal
• BAPI abuse
• CServer-side request forgery
• DPrivilege escalation

• A
  3% (1)
• B
  94% (29)
• D
  3% (1)

Explanation

API Abuse Explanation

Option B is correct because the penetration tester is fuzzing the Authorization Bearer token ([FUZZE]) against an API endpoint (/services/v1/users/create), which is a classic technique to test for broken authentication, unauthorized access, or improper token validation within an API - all hallmarks of API abuse. The structured REST API path (/services/v1/), JSON content type, and manipulation of the auth header confirm this is specifically targeting the API layer.

Why the distractors are wrong:

• A (Directory Traversal): This involves manipulating file paths (e.g., ../../etc/passwd) to access unauthorized files - no path manipulation is occurring here.
• C (SSRF): Server-Side Request Forgery tricks the server into making requests to internal resources - there's no URL/IP being injected into a parameter here.
• D (Privilege Escalation): While fuzzing tokens could lead to privilege escalation, the attack itself being performed is the API abuse technique of token fuzzing - privilege escalation would be the outcome, not the method.

Memory Tip: Look for the API path structure (/v1/, /api/, /services/) combined with token or parameter fuzzing - whenever you see [FUZZ] targeting an API endpoint, think API abuse. "Fuzzing the API = API abuse."

No community discussion yet for this question.